@devchitchat/chat 0.0.0

package/src/adapters/SqliteHubRepository.js

@@ -0,0 +1,99 @@
+import { runTransaction } from '../db/transaction.js'
+
+export class SqliteHubRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  insertHubWithOwner({ hubId, name, description, visibility, createdByUserId, now }) {
+    runTransaction(this.db, () => {
+      this.db.prepare(
+        `INSERT INTO hubs (hub_id, name, description, visibility, created_by_user_id, created_at)
+         VALUES (?, ?, ?, ?, ?, ?)`
+      ).run(hubId, name, description, visibility, createdByUserId, now)
+      this.db.prepare(
+        `INSERT INTO hub_members (hub_id, user_id, joined_at) VALUES (?, ?, ?)`
+      ).run(hubId, createdByUserId, now)
+    })
+  }
+
+  listAllHubs() {
+    return this.db.prepare(
+      `SELECT h.hub_id, h.name, h.description, h.visibility,
+         (SELECT COUNT(*) FROM channels c WHERE c.hub_id = h.hub_id AND c.deleted_at IS NULL) AS channel_count
+       FROM hubs h WHERE h.deleted_at IS NULL ORDER BY h.sort_order ASC, h.name ASC`
+    ).all()
+  }
+
+  listAccessibleHubs({ userId }) {
+    return this.db.prepare(
+      `SELECT h.hub_id, h.name, h.description, h.visibility,
+         (SELECT COUNT(*) FROM channels c WHERE c.hub_id = h.hub_id AND c.deleted_at IS NULL) AS channel_count
+       FROM hubs h WHERE h.deleted_at IS NULL
+       AND (h.visibility = 'public' OR EXISTS (
+         SELECT 1 FROM hub_members hm WHERE hm.hub_id = h.hub_id AND hm.user_id = ? AND hm.left_at IS NULL
+       ))
+       ORDER BY h.sort_order ASC, h.name ASC`
+    ).all(userId)
+  }
+
+  reorderHubs({ hubIds }) {
+    runTransaction(this.db, () => {
+      const stmt = this.db.prepare('UPDATE hubs SET sort_order = ? WHERE hub_id = ?')
+      hubIds.forEach((id, i) => stmt.run(i, id))
+    })
+  }
+
+  findById({ hubId }) {
+    return this.db.prepare('SELECT * FROM hubs WHERE hub_id = ?').get(hubId) ?? null
+  }
+
+  findByName({ name }) {
+    return this.db.prepare('SELECT * FROM hubs WHERE name = ? AND deleted_at IS NULL').get(name) ?? null
+  }
+
+  findMembership({ hubId, userId }) {
+    return this.db.prepare('SELECT * FROM hub_members WHERE hub_id = ? AND user_id = ?').get(hubId, userId) ?? null
+  }
+
+  upsertMembership({ hubId, userId, now }) {
+    this.db.prepare(
+      `INSERT INTO hub_members (hub_id, user_id, joined_at) VALUES (?, ?, ?)
+       ON CONFLICT(hub_id, user_id) DO UPDATE SET left_at = NULL`
+    ).run(hubId, userId, now)
+  }
+
+  setMemberLeft({ hubId, userId, now }) {
+    this.db.prepare('UPDATE hub_members SET left_at = ? WHERE hub_id = ? AND user_id = ?').run(now, hubId, userId)
+  }
+
+  listMembers({ hubId }) {
+    return this.db.prepare(
+      `SELECT u.user_id, u.handle, u.display_name, hm.joined_at
+       FROM hub_members hm JOIN users u ON hm.user_id = u.user_id
+       WHERE hm.hub_id = ? AND hm.left_at IS NULL
+       ORDER BY hm.joined_at ASC`
+    ).all(hubId)
+  }
+
+  patchHub({ hubId, name, description, visibility }) {
+    const updates = []
+    const params = []
+    if (name !== undefined) { updates.push('name = ?'); params.push(name) }
+    if (description !== undefined) { updates.push('description = ?'); params.push(description) }
+    if (visibility !== undefined) { updates.push('visibility = ?'); params.push(visibility) }
+    params.push(hubId)
+    this.db.prepare(`UPDATE hubs SET ${updates.join(', ')} WHERE hub_id = ?`).run(...params)
+  }
+
+  listActiveChannelIds({ hubId }) {
+    return this.db.prepare('SELECT channel_id FROM channels WHERE hub_id = ? AND deleted_at IS NULL').all(hubId).map(r => r.channel_id)
+  }
+
+  softDeleteHub({ hubId, now }) {
+    runTransaction(this.db, () => {
+      this.db.prepare('UPDATE hubs SET deleted_at = ? WHERE hub_id = ?').run(now, hubId)
+      this.db.prepare('UPDATE channels SET deleted_at = ? WHERE hub_id = ? AND deleted_at IS NULL').run(now, hubId)
+    })
+  }
+}

package/src/adapters/SqliteMessageRepository.js

@@ -0,0 +1,90 @@
+import { runTransaction } from '../db/transaction.js'
+
+const MSG_COLS = `m.msg_id, m.seq, m.user_id, u.display_name AS user_display_name, m.ts, m.text, m.edited_at, m.attachments_json`
+
+export class SqliteMessageRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  /**
+   * Atomically allocates the next seq, inserts the message and an audit event.
+   * Returns { seq }.
+   */
+  insertMessage({ msgId, channelId, userId, now, text, clientMsgId, priority = 'normal', attachmentsJson = null }) {
+    return runTransaction(this.db, () => {
+      const row = this.db.prepare('SELECT MAX(seq) AS max_seq FROM messages WHERE channel_id = ?').get(channelId)
+      const seq = (row?.max_seq || 0) + 1
+
+      this.db.prepare(
+        `INSERT INTO messages (msg_id, channel_id, seq, user_id, ts, text, client_msg_id, priority, attachments_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(msgId, channelId, seq, userId, now, text, clientMsgId, priority, attachmentsJson)
+
+      this.db.prepare(
+        `INSERT INTO events (ts, actor_user_id, scope_kind, scope_id, type, body_json)
+         VALUES (?, ?, 'channel', ?, 'msg.send', ?)`
+      ).run(now, userId, channelId, JSON.stringify({ msg_id: msgId, seq }))
+
+      return { seq }
+    })
+  }
+
+  listMessages({ channelId, afterSeq, limit }) {
+    const rows = this.db.prepare(
+      `SELECT ${MSG_COLS}
+       FROM messages m LEFT JOIN users u ON m.user_id = u.user_id
+       WHERE m.channel_id = ? AND m.seq > ? AND m.deleted_at IS NULL ORDER BY m.seq ASC LIMIT ?`
+    ).all(channelId, afterSeq, limit)
+    return rows.map(r => ({
+      ...r,
+      attachments: r.attachments_json ? JSON.parse(r.attachments_json) : [],
+      attachments_json: undefined,
+    }))
+  }
+
+  listLatestMessages({ channelId, limit }) {
+    const rows = this.db.prepare(
+      `SELECT ${MSG_COLS}
+       FROM messages m LEFT JOIN users u ON m.user_id = u.user_id
+       WHERE m.channel_id = ? AND m.deleted_at IS NULL
+       ORDER BY m.seq DESC LIMIT ?`
+    ).all(channelId, limit)
+    return rows.reverse().map(r => ({
+      ...r,
+      attachments: r.attachments_json ? JSON.parse(r.attachments_json) : [],
+      attachments_json: undefined,
+    }))
+  }
+
+  getById(msgId) {
+    return this.db.prepare(
+      `SELECT msg_id, channel_id, seq, user_id, ts, text, deleted_at FROM messages WHERE msg_id = ?`
+    ).get(msgId) ?? null
+  }
+
+  updateMessage({ msgId, text, editedAt }) {
+    this.db.prepare(
+      `UPDATE messages SET text = ?, edited_at = ? WHERE msg_id = ?`
+    ).run(text, editedAt, msgId)
+  }
+
+  deleteMessage({ msgId, deletedAt }) {
+    this.db.prepare(
+      `UPDATE messages SET deleted_at = ? WHERE msg_id = ?`
+    ).run(deletedAt, msgId)
+  }
+
+  listMessagesBefore({ channelId, beforeSeq, limit }) {
+    const rows = this.db.prepare(
+      `SELECT ${MSG_COLS}
+       FROM messages m LEFT JOIN users u ON m.user_id = u.user_id
+       WHERE m.channel_id = ? AND m.seq < ? AND m.deleted_at IS NULL
+       ORDER BY m.seq DESC LIMIT ?`
+    ).all(channelId, beforeSeq, limit)
+    return rows.reverse().map(r => ({
+      ...r,
+      attachments: r.attachments_json ? JSON.parse(r.attachments_json) : [],
+      attachments_json: undefined,
+    }))
+  }
+}

package/src/adapters/SqlitePushRepository.js

@@ -0,0 +1,39 @@
+import { newId } from '../util/ids.js'
+
+export class SqlitePushRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  /** Upsert a push subscription for a user. */
+  upsertSubscription({ userId, endpoint, p256dh, auth }) {
+    const existing = this.db.prepare('SELECT sub_id FROM push_subscriptions WHERE endpoint = ?').get(endpoint)
+    const now = Date.now()
+    if (existing) {
+      this.db.prepare(
+        'UPDATE push_subscriptions SET user_id = ?, p256dh = ?, auth = ?, last_used_at = ? WHERE endpoint = ?'
+      ).run(userId, p256dh, auth, now, endpoint)
+    } else {
+      this.db.prepare(
+        'INSERT INTO push_subscriptions (sub_id, user_id, endpoint, p256dh, auth, created_at) VALUES (?, ?, ?, ?, ?, ?)'
+      ).run(newId('ps'), userId, endpoint, p256dh, auth, now)
+    }
+  }
+
+  /** Return all subscriptions for a user. */
+  getSubscriptionsForUser(userId) {
+    return this.db.prepare(
+      'SELECT endpoint, p256dh, auth FROM push_subscriptions WHERE user_id = ?'
+    ).all(userId)
+  }
+
+  /** Remove a subscription by endpoint (called when push returns 410/404). */
+  removeSubscription(endpoint) {
+    this.db.prepare('DELETE FROM push_subscriptions WHERE endpoint = ?').run(endpoint)
+  }
+
+  /** Remove all subscriptions for a user (e.g. on sign-out). */
+  removeAllForUser(userId) {
+    this.db.prepare('DELETE FROM push_subscriptions WHERE user_id = ?').run(userId)
+  }
+}

package/src/adapters/SqliteReactionRepository.js

@@ -0,0 +1,50 @@
+export class SqliteReactionRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  /** Returns void. UNIQUE constraint is the idempotency guard. */
+  upsertReaction({ reactionId, msgId, channelId, userId, emoji, ts }) {
+    this.db.prepare(
+      `INSERT INTO message_reactions (reaction_id, msg_id, channel_id, user_id, emoji, ts)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT (msg_id, user_id, emoji) DO NOTHING`
+    ).run(reactionId, msgId, channelId, userId, emoji, ts)
+  }
+
+  /** Returns void. No-op if the row doesn't exist. */
+  removeReaction({ msgId, userId, emoji }) {
+    this.db.prepare(
+      `DELETE FROM message_reactions WHERE msg_id = ? AND user_id = ? AND emoji = ?`
+    ).run(msgId, userId, emoji)
+  }
+
+  /**
+   * Returns Map<msgId, [{emoji, count, reacted}]>
+   * requestingUserId used to compute the `reacted` flag.
+   */
+  listReactionsForMsgs({ msgIds, requestingUserId }) {
+    if (!msgIds || msgIds.length === 0) return new Map()
+
+    const placeholders = msgIds.map(() => '?').join(', ')
+    const rows = this.db.prepare(
+      `SELECT msg_id, emoji, COUNT(*) AS count,
+              MAX(CASE WHEN user_id = ? THEN 1 ELSE 0 END) AS reacted
+       FROM message_reactions
+       WHERE msg_id IN (${placeholders})
+       GROUP BY msg_id, emoji
+       ORDER BY MIN(ts) ASC`
+    ).all(requestingUserId, ...msgIds)
+
+    const map = new Map()
+    for (const row of rows) {
+      if (!map.has(row.msg_id)) map.set(row.msg_id, [])
+      map.get(row.msg_id).push({
+        emoji: row.emoji,
+        count: row.count,
+        reacted: row.reacted === 1,
+      })
+    }
+    return map
+  }
+}

package/src/adapters/SqliteSearchRepository.js

@@ -0,0 +1,42 @@
+export class SqliteSearchRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  isFtsEnabled() {
+    try {
+      const row = this.db.prepare("SELECT sql FROM sqlite_master WHERE name = 'fts_messages'").get()
+      return !!row?.sql && row.sql.toUpperCase().includes('VIRTUAL TABLE')
+    } catch {
+      return false
+    }
+  }
+
+  indexMessage({ msg_id, channel_id, seq, user_id, ts, text }) {
+    this.db.prepare(
+      `INSERT INTO fts_messages (text, channel_id, msg_id, seq, user_id, ts) VALUES (?, ?, ?, ?, ?, ?)`
+    ).run(text, channel_id, msg_id, seq, user_id, ts)
+  }
+
+  removeMessage({ msgId }) {
+    this.db.prepare(`DELETE FROM fts_messages WHERE msg_id = ?`).run(msgId)
+  }
+
+  searchFts({ channelId, query, limit }) {
+    return this.db.prepare(
+      `SELECT m.channel_id, m.msg_id, m.seq, m.user_id, m.ts,
+         snippet(fts_messages, 0, '<mark>', '</mark>', '…', 10) AS snippet
+       FROM fts_messages
+       JOIN messages m ON m.msg_id = fts_messages.msg_id
+       WHERE fts_messages MATCH ? AND m.channel_id = ?
+       ORDER BY bm25(fts_messages) LIMIT ?`
+    ).all(query, channelId, limit)
+  }
+
+  searchLike({ channelId, query, limit }) {
+    return this.db.prepare(
+      `SELECT channel_id, msg_id, seq, user_id, ts, text AS snippet
+       FROM fts_messages WHERE channel_id = ? AND text LIKE ? LIMIT ?`
+    ).all(channelId, `%${query}%`, limit)
+  }
+}

package/src/adapters/SqliteSignalingRepository.js

@@ -0,0 +1,50 @@
+export class SqliteSignalingRepository {
+  constructor({ db }) {
+    this._findActiveByChannel = db.prepare(`
+      SELECT call_id, channel_id, created_by_user_id, topology, started_at
+        FROM calls WHERE channel_id = ? AND ended_at IS NULL LIMIT 1
+    `)
+    this._findActiveCalls = db.prepare(`
+      SELECT call_id, channel_id, created_by_user_id, topology, started_at
+        FROM calls WHERE ended_at IS NULL
+    `)
+    this._insertCall = db.prepare(`
+      INSERT INTO calls (call_id, channel_id, created_by_user_id, topology, started_at)
+        VALUES (?, ?, ?, ?, ?)
+    `)
+    this._endCall = db.prepare(`
+      UPDATE calls SET ended_at = ? WHERE call_id = ?
+    `)
+    this._insertParticipant = db.prepare(`
+      INSERT INTO call_participants (call_id, user_id, peer_id, joined_at)
+        VALUES (?, ?, ?, ?)
+    `)
+    this._leaveParticipant = db.prepare(`
+      UPDATE call_participants SET left_at = ? WHERE call_id = ? AND peer_id = ?
+    `)
+  }
+
+  findActiveByChannel({ channelId }) {
+    return this._findActiveByChannel.get(channelId) ?? null
+  }
+
+  findActiveCalls() {
+    return this._findActiveCalls.all()
+  }
+
+  insertCall({ callId, channelId, createdByUserId, topology, startedAt }) {
+    this._insertCall.run(callId, channelId, createdByUserId, topology, startedAt)
+  }
+
+  endCall({ callId, endedAt }) {
+    this._endCall.run(endedAt, callId)
+  }
+
+  insertParticipant({ callId, userId, peerId, joinedAt }) {
+    this._insertParticipant.run(callId, userId, peerId, joinedAt)
+  }
+
+  leaveParticipant({ callId, peerId, leftAt }) {
+    this._leaveParticipant.run(leftAt, callId, peerId)
+  }
+}

package/src/adapters/SqliteUploadRepository.js

@@ -0,0 +1,34 @@
+export class SqliteUploadRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  insert({ uploadId, uploaderUserId, channelId, originalName, storedName, mimeType, sizeBytes, now }) {
+    this.db.prepare(
+      `INSERT INTO uploads (upload_id, uploader_user_id, channel_id, original_name, stored_name, mime_type, size_bytes, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(uploadId, uploaderUserId, channelId, originalName, storedName, mimeType, sizeBytes, now)
+  }
+
+  findById({ uploadId }) {
+    return this.db.prepare(
+      `SELECT * FROM uploads WHERE upload_id = ?`
+    ).get(uploadId) ?? null
+  }
+
+  linkToMessage({ uploadId, msgId }) {
+    this.db.prepare(
+      `UPDATE uploads SET msg_id = ? WHERE upload_id = ?`
+    ).run(msgId, uploadId)
+  }
+
+  findOrphansOlderThan({ thresholdTs }) {
+    return this.db.prepare(
+      `SELECT * FROM uploads WHERE msg_id IS NULL AND created_at < ?`
+    ).all(thresholdTs)
+  }
+
+  delete({ uploadId }) {
+    this.db.prepare(`DELETE FROM uploads WHERE upload_id = ?`).run(uploadId)
+  }
+}

package/src/adapters/SqliteUserSettingsRepository.js

@@ -0,0 +1,23 @@
+export class SqliteUserSettingsRepository {
+  constructor({ db }) {
+    this.db = db
+  }
+
+  findByUserId({ userId }) {
+    return this.db.prepare(
+      `SELECT settings_json, updated_at FROM user_settings WHERE user_id = ?`
+    ).get(userId) ?? null
+  }
+
+  // Upsert only when the incoming updated_at is >= the stored value (last-write-wins)
+  upsert({ userId, settingsJson, updatedAt }) {
+    this.db.prepare(`
+      INSERT INTO user_settings (user_id, settings_json, updated_at)
+        VALUES (?, ?, ?)
+      ON CONFLICT (user_id) DO UPDATE
+        SET settings_json = excluded.settings_json,
+            updated_at    = excluded.updated_at
+        WHERE excluded.updated_at >= user_settings.updated_at
+    `).run(userId, settingsJson, updatedAt)
+  }
+}

package/src/adminAuth.js

@@ -0,0 +1,25 @@
+/**
+ * adminAuth — shared guard for admin HTTP pages.
+ *
+ * Usage in a page handler:
+ *   import { requireAdminSession } from '../../src/adminAuth.js'
+ *   const session = requireAdminSession(req)
+ *   if (session instanceof Response) return session  // redirect to login
+ */
+import { sessionFromRequest, logger } from './context.js'
+
+/**
+ * Returns the validated admin session, or a redirect Response if the user
+ * is not authenticated or lacks the admin role.
+ */
+export function requireAdminSession(req) {
+  const session = sessionFromRequest(req)
+  if (!session) {
+    return Response.redirect(new URL('/login', req.url), 302)
+  }
+  if (!session.user.roles.includes('admin')) {
+    logger?.warn('admin.access_denied', { userId: session.user.user_id, url: req.url })
+    return new Response('Forbidden', { status: 403 })
+  }
+  return session
+}

package/src/config.js

@@ -0,0 +1,11 @@
+/**
+ * config.js — shared server-side configuration.
+ *
+ * BASE_PATH: the URL subpath the app is mounted at (e.g. "/chat").
+ * Defaults to "" (root). Trailing slash is stripped automatically.
+ *
+ * p(path) — path helper: prepends BASE_PATH to any absolute path string.
+ * Use it everywhere a literal server-side path is constructed.
+ */
+export const BASE_PATH = (process.env.BASE_PATH ?? '').replace(/\/$/, '')
+export const p = (path) => `${BASE_PATH}${path}`

package/src/context.js

@@ -0,0 +1,77 @@
+/**
+ * Service context singleton.
+ *
+ * index97 imports page handlers dynamically. ES modules are singletons,
+ * so any handler that imports from this file gets the same live references
+ * that were wired up in index.js at startup.
+ *
+ * Usage in a page handler:
+ *   import { auth, channelService, messageService } from '../../src/context.js'
+ */
+
+export let auth = null
+export let hubService = null
+export let channelService = null
+export let messageService = null
+export let deliveryService = null
+export let searchService = null
+export let presenceService = null
+export let signalingService = null
+export let userSettingsService = null
+export let botService = null
+export let uploadService = null
+export let reactionService = null
+export let logger = null
+
+export function init(services) {
+  auth = services.auth
+  hubService = services.hubService
+  channelService = services.channelService
+  messageService = services.messageService
+  deliveryService = services.deliveryService
+  searchService = services.searchService
+  presenceService = services.presenceService
+  signalingService = services.signalingService
+  userSettingsService = services.userSettingsService
+  botService = services.botService
+  uploadService = services.uploadService
+  reactionService = services.reactionService
+  logger = services.logger
+}
+
+/**
+ * Parse session token from a request's cookie header.
+ * Returns { session, user } or null if unauthenticated.
+ */
+export function sessionFromRequest(req) {
+  const cookie = req.headers.get('cookie') || ''
+  const match = cookie.match(/(?:^|;\s*)session=([^;]+)/)
+  if (!match) return null
+  return auth.validateSession(decodeURIComponent(match[1]))
+}
+
+/**
+ * Authenticate a bot via an Authorization: Bearer <token> header.
+ * Returns { user_id, handle, displayName, roles } or null if not authenticated.
+ */
+export async function botUserFromRequest(req) {
+  const authHeader = req.headers.get('authorization') ?? ''
+  const match = authHeader.match(/^Bearer\s+(.+)$/i)
+  if (!match) return null
+  try {
+    const bot = await botService.authenticateToken(match[1])
+    if (!bot) return null
+    // Normalize to the same shape as session.user so callers use user_id consistently.
+    return { user_id: bot.userId, handle: bot.handle, displayName: bot.displayName, roles: bot.roles }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Build a Set-Cookie header string for a session token.
+ */
+export function sessionCookie(token, { maxAgeSec = 30 * 24 * 60 * 60, clear = false } = {}) {
+  if (clear) return 'session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0'
+  return `session=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}`
+}

package/src/core/dm.js

@@ -0,0 +1,10 @@
+/**
+ * buildDmChannelName — deterministic canonical key for a DM channel.
+ *
+ * Sorting the two user IDs alphabetically ensures the same name regardless
+ * of who initiates: dm:u_abc:u_xyz == dm:u_xyz:u_abc.
+ */
+export function buildDmChannelName(userIdA, userIdB) {
+  const [a, b] = [userIdA, userIdB].sort()
+  return `dm:${a}:${b}`
+}

package/src/core/mentions.js

@@ -0,0 +1,27 @@
+/**
+ * parseMentions — extract @handle mentions from a message and resolve them to users.
+ *
+ * @param {string} text — raw message text
+ * @param {Array<{ user_id: string, handle: string }>} members — channel members to match against
+ * @returns {Array<{ user_id: string, handle: string }>} — deduplicated matched members
+ */
+export function parseMentions(text, members = []) {
+  if (!text || members.length === 0) return []
+  const byHandle = new Map(
+    members
+      .filter(m => m.handle)
+      .map(m => [m.handle.toLowerCase(), m])
+  )
+  const seen = new Set()
+  const results = []
+  const pattern = /@([a-zA-Z0-9_.-]+)/g
+  let match
+  while ((match = pattern.exec(text)) !== null) {
+    const handle = match[1].toLowerCase()
+    if (byHandle.has(handle) && !seen.has(handle)) {
+      seen.add(handle)
+      results.push(byHandle.get(handle))
+    }
+  }
+  return results
+}

package/src/core/messages.js

@@ -0,0 +1,21 @@
+import { ServiceError } from '../util/errors.js'
+
+export function validateEditPermission(requestingUserId, authorUserId) {
+  if (requestingUserId !== authorUserId)
+    throw new ServiceError('FORBIDDEN', 'Only the author can edit this message')
+}
+
+export function validateEditText(text) {
+  const trimmed = (text ?? '').trim()
+  if (!trimmed) throw new ServiceError('BAD_REQUEST', 'Message text cannot be empty')
+  return trimmed
+}
+
+export function assertMessageEditable(deletedAt) {
+  if (deletedAt != null) throw new ServiceError('BAD_REQUEST', 'Cannot edit a deleted message')
+}
+
+export function validateDeletePermission(requestingUserId, authorUserId) {
+  if (requestingUserId !== authorUserId)
+    throw new ServiceError('FORBIDDEN', 'Only the author can delete this message')
+}

package/src/core/reactions.js

@@ -0,0 +1,6 @@
+import { ServiceError } from '../util/errors.js'
+
+export function validateEmoji(emoji) {
+  if (typeof emoji !== 'string') throw new ServiceError('BAD_REQUEST', 'emoji must be a string')
+  if (!emoji || [...emoji].length > 4) throw new ServiceError('BAD_REQUEST', 'Invalid emoji')
+}

package/src/core/roles.js

@@ -0,0 +1,5 @@
+export const ROLES = ['admin', 'user', 'guest', 'bot']
+
+export const isAdmin = (roles = []) => roles.includes('admin')
+export const isGuest = (roles = []) => roles.includes('guest')
+export const isBot   = (roles = []) => roles.includes('bot')